[LU-17624] SSK cannot be set up on a FIPS-enabled client

• Type: Bug
• Resolution: Fixed
• Priority: Minor
• Fix Version/s: Lustre 2.16.0
• Affects Version/s: Lustre 2.16.0
• Labels: SSK patch sec
• Severity: 3
• Assignee: Sebastien Buisson
• Reporter: Sebastien Buisson

Description

When trying to setup SSK on a FIPS enabled client we get:

# lgss_sk -t client -m /ssk_dir/testfs.server.key
Generating DH parameters, this can take a while...
error: cannot generate DH parameters

Adding more debug traces, we can see:

error:050C90CA:Diffie-Hellman routines:DH_generate_parameters_ex:non FIPS method

In FIPS mode, only certain crypto methods are allowed.

Comments

[Peter Jones]

Merged for 2.16

[Gerrit Updater]

"Oleg Drokin <[e-mail]>" merged in patch https://review.whamcloud.com/c/fs/lustre-release/+/54314/
Subject: LU-17624 ssk: support FIPS mode on client
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: 5dc91df283fb5a7030b384f224085d73268dcca5

[Gerrit Updater]

"Sebastien Buisson <[e-mail]>" uploaded a new patch: https://review.whamcloud.com/c/fs/lustre-release/+/54314
Subject: LU-17624 ssk: support FIPS mode on client
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: b0c3a7595036d54ef7db277ca4fbd6c424a1921d